Junior Python Backend Developer · Application Security (AppSec)
Barcelona, Spain · Open to junior opportunities
I’m Fernando, a Python developer in Barcelona building practical projects at the intersection of backend engineering and application security.
I’m interested in the details that make software dependable: how an API handles identity and permissions, how a test proves that access is denied when it should be, how a security finding is recorded, and how another developer can reproduce the result. I use personal projects and labs to investigate those questions, then document what worked, what did not, and what still needs improvement.
I’m looking for a junior Python Backend or Application Security opportunity where I can contribute, learn through code review, and grow alongside an engineering team.
- Portfólio online - silvatechf-portifolio.vercel.app
| Backend | Application security | Engineering habits |
|---|---|---|
| Python · FastAPI · REST APIs | Authorization · Static analysis · Secure coding | Tests · CI · Clear documentation |
- I start with a concrete problem. I keep the scope understandable and make the intended behavior explicit.
- I test boundary cases. I include denial paths and failure conditions, not only successful requests.
- I make results reviewable. I document setup, assumptions, tests, and known limitations.
- I am precise about maturity. I label learning projects and labs accordingly; a passing test suite is evidence, not a claim of production readiness.
These four projects best represent my current direction. I include links to each repository’s implementation details, setup instructions, and known limitations.
Python AST-based static-analysis lab for selected SQL injection and path-traversal patterns, with structured audit logs and a CI security gate. Focus: bounded remediation and local Loki/Grafana observability. Limit: its benchmark has 10 self-authored cases; this is not evidence of real-world accuracy or a replacement for mature SAST. |
FastAPI and PyJWT project exploring centralized, fail-closed authorization for a multi-tenant API. Focus: roles, scopes, ownership, tenant isolation, and denial-path tests. Educational project; not a production-ready identity platform. |
Hands-on lab for studying secure software engineering, API security, cryptography, and defensive analysis. |
Python CLI that turns structured security findings into PDF reports, with study-oriented mappings to Spanish security and data-protection frameworks. Regulatory mappings are educational references, not legal advice. |
Technologies used across projects and exercises; depth varies by repository. Icons are a visual index, not a claim of professional production experience with every tool.
Focused experiments, kept separate from the featured projects. These are learning environments, not commercial security products.
| Lab | What it explores |
|---|---|
| Triage Pipeline | Authentication telemetry and heuristic triage |
| Async EASM | Asynchronous attack-surface discovery for authorized targets |
| Spec CTI | Threat intelligence and security-analysis workflows |
| SSH Monitoring Lab | Security monitoring and event analysis |
| Network Security Analytics | Network-security data analysis |
| AWS Security Foundation | Cloud-security fundamentals and configuration |
I document setup, tests, and limitations in each repository. I assess only systems I own or am explicitly authorized to test.
Additional product, academic, and full-stack work:
- DuckyArenas — DuckyShop & DuckyBank contribution — academic team project; my contribution focuses on Django backend components for the shop/catalog, wallet transactions, purchase coordination, and idempotency. Individual case study · Related idempotency test PR #122 remains a separate review item.
- MEI em Dia — React/Vite PWA for guided information and local task organization.
- AI Job Agent — Java Spring Boot and React application for CV/job-description analysis.
- SmartSpend — multi-technology finance application.
- Wildfire Observer — Python-based geospatial and wildfire-analysis project.
Coursework and coding challenges that document my progression — distinct from the featured projects:
Python Cybersecurity OOP · DIO Java Basics · DIO OOP Challenge · Control Flow Challenge · Java Design Patterns · Spring Design Patterns
Python backend fundamentals ◇ API design ◇ AppSec testing
Threat modeling ◇ Repeatable CI security checks
- Prefer explicit, testable security rules over implicit assumptions.
- Test denial and failure paths as deliberately as success paths.
- Separate measured results from assumptions, and document limitations.
- Make projects easier to install, test, understand, and review.
